[lidge-jun]

GOAT's managed relay client still downloads cloudflared 2026.10.0. Take upstream's security-motivated 2026.10.4 pin and update every platform URL and SHA-256 together.

Upstream commit	Upstream PR	Verdict	What GOAT got
b6994c549977dd194d38f95902fcfac0445d8fa1	pingdotgg/t3code#25572	take (git cherry-pick -x)	cloudflared 2026.10.4 and all six platform entries / five release assets

GOAT adjustments:

• Preserve GOAT_CLOUDFLARED_PATH, the existing managed installer, and Windows ARM64's x64 asset selection.
• Keep the minimum at 2025.6.1. User-selected override and PATH binaries remain user-managed; this does not upgrade them or enable GOAT Connect.
• Add installation regression coverage for all six platform selections, including their URLs, published digests, archive extraction, and installed version. The manifest fixtures supply published digests and mock subprocesses; the separate native smoke below uses the real download and checksum implementation.
• Strengthen checksum rejection coverage to assert that tampered bytes are neither executed nor activated. Cover acceptance of an explicit 2025.6.1 override; existing coverage rejects outdated overrides and PATH candidates.

Hash provenance: a fresh comparison against Cloudflare's GitHub release asset metadata matched all six manifest entries. The macOS hashes in the release description differ from its asset metadata; the pin follows the asset digests, as upstream does.

Rename residue:

• git show b6994c5499 --format= -- | rg '^\+.*\b[Tt]3': no added T3 names (no matches, exit 1). There are no added names to rename, exclude, or retain.
• node scripts/goat-rename.ts --apply ran; unrelated baseline fixture rewrites were restored. GOAT identity remains intact without a rename-rule change.
• node scripts/goat-rename.ts --check: exit 0, zero residue lines and zero dropped paths.

Verification:

• vp env exec node -v: v26.12.1.
• Red: vp test run packages/shared/src/relayClient.test.ts -t '2026.10.4 release' before the cherry-pick: all six platform cases failed with invalid_checksum against the old manifest.
• Green: vp test run packages/shared/src/relayClient.test.ts: 21 passed, zero failures or skips.
• lockf -k /tmp/goat-heavy-check.lock vp test run packages/shared/src/relayClient.test.ts apps/server/src/cloud/ManagedEndpointRuntime.test.ts apps/server/src/cli/connect.test.ts: 3 files, 38 tests passed, zero failures or skips.
• lockf -k /tmp/goat-heavy-check.lock vp run check:changed: exit 0. Format, lint, both knip passes, all 32 affected package typechecks, and 5 test files / 55 tests passed. The complete log contains compiler suggestions, with no error or warning diagnostics.
• gh api repos/cloudflare/cloudflared/releases/tags/2026.10.4 plus a Python comparison against the manifest: all six target entries matched the five distinct asset digests; minimum version remains 2025.6.1.
• Native smoke: vp env exec node --input-type=module from packages/shared, invoking RelayClient.install with Node services and FetchHttpClient in a scoped temporary home on macOS ARM64. Real download, SHA-256 verification, extraction, version validation, activation, and resolution passed: installed and resolved source managed, version 2026.10.4. The temporary home was removed.
• git diff --check origin/dev...HEAD: exit 0.

NOT RUN: native installs/execution on macOS x64, Linux, and Windows; live relay tunnel or client UI; full repository suites, build, or release smoke; CI completion, independent review, or merge (integration lane owns those).

Model: gpt-6.1-sol via GOAT delegated task (Codex harness)